US20020138738A1 - Method and apparatus for securely and dynamically managing user attributes in a distributed system - Google Patents

Method and apparatus for securely and dynamically managing user attributes in a distributed system Download PDF

Info

Publication number
US20020138738A1
US20020138738A1 US09813419 US81341901A US2002138738A1 US 20020138738 A1 US20020138738 A1 US 20020138738A1 US 09813419 US09813419 US 09813419 US 81341901 A US81341901 A US 81341901A US 2002138738 A1 US2002138738 A1 US 2002138738A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
attribute
database
user
system
attributes
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US09813419
Other versions
US6871279B2 (en )
Inventor
David Sames
Gregg Tally
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
McAfee LLC
Original Assignee
Networks Associates Technology Inc
Network Associates Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416Event detection, e.g. attack signature detection
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10TECHNICAL SUBJECTS COVERED BY FORMER USPC
    • Y10STECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10S707/00Data processing: database and file management or data structures
    • Y10S707/99931Database or file accessing
    • Y10S707/99939Privileged access
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10TECHNICAL SUBJECTS COVERED BY FORMER USPC
    • Y10STECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10S707/00Data processing: database and file management or data structures
    • Y10S707/99941Database schema or data structure
    • Y10S707/99944Object-oriented database structure
    • Y10S707/99945Object-oriented database structure processing

Abstract

One embodiment of the present invention provides a system for managing user attributes that determines access rights in a distributed computing system. The system modifies an attribute database, wherein the attribute database includes a plurality of possible user attributes and a plurality of users. Next, for a given user the system obtains an identity certificate from a certificate authority. This identity certificate is associated with a user from the attribute database. The system also assigns an attribute to the user from the possible user attributes, whereby the user is granted access rights based on the attribute and the identity certificate. This attribute is stored in the attribute database. Finally, modifications to the attribute database are distributed to a plurality of hosts coupled together by a network.

Description

    GOVERNMENT LICENCE RIGHTS
  • [0001] This invention was made with United States Government support under contract #F30602-97-C-92-0268 funded by the Defense Advanced Research Projects Agency (DARPA) through Rome Laboratories. The United States Government has certain rights in the invention.
  • BACKGROUND
  • [0002]
    1. Field of the Invention
  • [0003]
    The present invention relates to distributed systems. More specifically, the present invention relates to a method and an apparatus for securely and dynamically managing user attributes in distributed systems.
  • [0004]
    2. Related Art
  • [0005]
    The recent explosion of distributed computing systems and their attendant problems have led to many innovative solutions to ensure commonality, interoperability, and standardization.
  • [0006]
    One of the more perplexing problems associated with distributed computing systems is access control. Typically, a security administrator establishes access control mechanisms based on the privilege attributes of a user, such as user roles. User roles can include accountant, payroll clerk, order entry clerk, and the like. A user is granted access to only the required data to perform the functions of an assigned attribute and is prevented from accessing data that is not required to perform these functions. It should be noted that a user can be authorized for several roles and can select any authorized role for access at a given time. Access identity, group, and clearance level are examples of other privilege attributes that might be used for making access decisions.
  • [0007]
    One method for establishing access control is to use X.509 certificates. X.509 certificates are typically issued, signed, and maintained by a certificate authority (CA). There are currently two kinds of information supported by X.509 certificates: identity and attributes. Authentication services use identity certificates to verify the identity of a user, while attribute certificates contain privilege attribute information associated with the user such as a user role, access identity, group, or clearance level. Under X.509, an attribute certificate must be bound to an identity certificate.
  • [0008]
    Using attribute certificates causes difficulties for managing user attributes. A user must be issued one or more attribute certificates for each assigned attribute. Issuing these attribute certificates ties the access control mechanism directly to a public key infrastructure, thereby making the process of issuing attribute certificates more difficult. In addition, an attribute certificate must be checked for validity each time the user assumes the attribute authorized by the certificate.
  • [0009]
    Typically, checking the attribute certificate for validity involves scanning certificate revocation lists (CRLs) maintained by the CA. Checking these CRLs can be a time consuming process, which is exacerbated by the use of attribute certificates for attribute management. Using attribute certificates also requires a secure method to distribute the attribute assignments from the administrative area where the assignment is made to the access control engine actually making the decision. In addition, distribution of CRLs is an issue because CRLs can grow very large for a large organization. Information within a CRL must be retained until the certificate expires.
  • [0010]
    Another way to establish access control is by using extensions to X.509 certificates to indicate the user's assigned attributes. These extensions, however, impose additional administrative overhead and support requirements within a system. Furthermore, many certificate servers do not enable certificate extensions, and many secure socket layer (SSL) applications do not support certificates with extensions. Therefore, using extensions to X.509 certificates is not a viable solution.
  • [0011]
    What is needed is a method and an apparatus for managing user attributes in a distributed system, without using certificates for attribute-based access control.
  • SUMMARY
  • [0012]
    One embodiment of the present invention provides a system for managing user attributes that determines access rights in a distributed computing system. The system modifies an attribute database, wherein the attribute database includes a plurality of possible user attributes and a plurality of users. Next, for a given user the system obtains an identity certificate from a certificate authority. This identity certificate is associated with a user from the attribute database. The system also assigns an attribute to the user from the possible user attributes, whereby the user is granted access rights based on the attribute and the identity certificate. This attribute is stored in the attribute database. Finally, modifications to the attribute database are distributed to a plurality of hosts coupled together by a network.
  • [0013]
    In one embodiment of the present invention, the system assigns a second attribute from the possible user attributes to the user, based on an additional assigned function for the user. The system stores this second attribute in the attribute database.
  • [0014]
    In one embodiment of the present invention, the system uses secure communications for distributing modifications to the attribute database to the plurality of hosts.
  • [0015]
    In one embodiment of the present invention, the system signs the attribute database with a cryptographic signature to allow detection of unauthorized changes to the attribute database.
  • [0016]
    In one embodiment of the present invention, a host can distribute modifications to the attribute database to a subordinate host in a tree architecture.
  • [0017]
    In one embodiment of the present invention, the system allows the user to assume any attribute stored in the attribute database that is assigned to the user.
  • [0018]
    In one embodiment of the present invention, the system deletes the attribute assigned to the user from the attribute database. After deleting the attribute from the attribute database, the system redistributes the attribute database to the plurality of hosts.
  • [0019]
    In one embodiment of the present invention, modifying the attribute database includes creating a new attribute database.
  • BRIEF DESCRIPTION OF THE FIGURES
  • [0020]
    [0020]FIG. 1 illustrates host systems coupled together in accordance with an embodiment of the present invention.
  • [0021]
    [0021]FIG. 2A illustrates details of attribute database 200 in accordance with an embodiment of the present invention.
  • [0022]
    [0022]FIG. 2B illustrates attribute mapping within attribute database 200 in accordance with an embodiment of the present invention.
  • [0023]
    [0023]FIG. 3 is a flowchart illustrating the process of creating an attribute database in accordance with an embodiment of the present invention.
  • [0024]
    [0024]FIG. 4 is a flowchart illustrating the process of adding and deleting a user to an attribute database in accordance with an embodiment of the present invention.
  • [0025]
    [0025]FIG. 5 is a flowchart illustrating the process of adding and deleting an attribute for a user in accordance with an embodiment of the present invention.
  • [0026]
    [0026]FIG. 6 is a flowchart illustrating the process of distributing an attribute database in accordance with an embodiment of the present invention.
  • DETAILED DESCRIPTION
  • [0027]
    The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.
  • [0028]
    The data structures and code described in this detailed description are typically stored on a computer readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs) and DVDs (digital versatile discs or digital video discs), and computer instruction signals embodied in a transmission medium (with or without a carrier wave upon which the signals are modulated). For example, the transmission medium may include a communications network, such as the Internet.
  • [0029]
    Host Computing Systems
  • [0030]
    [0030]FIG. 1 illustrates host systems coupled together in accordance with an embodiment of the present invention. Master host 100, and hosts 110 and 120 are coupled together by network 130. The system can include additional hosts. Master host 100, hosts 110 and 120, and any additional hosts within the system are arranged logically into a hierarchy with master host 100 at the top of the hierarchy. Additional hosts may be arranged to be logically subordinate to master host 100, host 110, host 120, or to any other host within the hierarchy.
  • [0031]
    Master host 100 and hosts 110 and 120 can generally include any type of computer system, including, but not limited to, a computer system based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a personal organizer, a device controller, and a computational engine within an appliance.
  • [0032]
    Network 130 can generally include any type of wire or wireless communication channel capable of coupling together computing nodes. This includes, but is not limited to, a local area network, a wide area network, or a combination of networks. In one embodiment of the present invention, network 130 includes the Internet.
  • [0033]
    Master host 100, and hosts 110 and 120 include policy distributors 102, 112 and 122, application clients 104, 114, and 124, and application servers 106, 116, and 126 respectively. In addition, master host 100, and hosts 110 and 120 are coupled to master attribute database 108, and local attribute databases 118 and 128 respectively. Any additional host within the system has a configuration equivalent to the configuration of hosts 110 and 120.
  • [0034]
    During operation of the system, security administrator 132 interacts with master host 100 to create and maintain master attribute database 108. The master attribute database includes a list of users, a list of possible attributes, and a mapping of attributes to users. It should be noted that the mapping is a many-to-many mapping such that a user can be mapped to more than one attribute and more than one user can be mapped to an attribute.
  • [0035]
    After master attribute database 108 has been created, policy distributor 102 establishes a secure link with policy distributors 112 and 122 within hosts 110 and 120 respectively. Policy distributors 102, 112, and 122 operate in concert to copy master attribute database 108 to local attribute database 118 and local attribute database 128. In like manner, each policy distributor may contact other policy distributors within the system to provide each host within the system a local attribute database. Note that master attribute database 108 is signed with a cryptographic signature prior to distribution so that tampering with master attribute database 108, and local attribute databases 118 and 128 can be detected.
  • [0036]
    Application clients 104, 114, and 124 and application servers 106, 116, and 126 validate user access rights by accessing master attribute database 108 and local attribute databases 118 and 128 respectively. Application clients 104, 114, and 124 and application servers 106, 116, and 126 are notified by policy distributors 102, 112, and 122 when master attribute database 108 and local attribute databases 118 and 128 respectively have been updated.
  • [0037]
    Attribute Database
  • [0038]
    [0038]FIG. 2A illustrates details of attribute database 200 in accordance with an embodiment of the present invention. Attribute database 200 includes a list of users 202, a list of possible attributes 204, and a default attribute 206. Attribute database 200 can be stored on any type of system for storing data in non-volatile storage. This includes, but is not limited to, systems based upon magnetic, optical, and magneto-optical storage devices, as well as storage devices based on flash memory and/or battery-backed up memory.
  • [0039]
    Default attribute 206 is provided to give all users within users 202 a minimum set of privileges. Security administrator 132 authorizes each user from users 202 access to one or more of attributes 204 to increase a user's privileges as described in conjunction with FIG. 2B.
  • [0040]
    Users 202 includes user 208, 210, 212, 214, 216, 218, 220, and 222. Attributes 204 includes attribute 224, 226, 228, 230, 232, and 234. It will be obvious to a practitioner skilled in the art that security administrator 132 can extend users 202 and attributes 204 to any practical limit.
  • [0041]
    [0041]FIG. 2B illustrates attribute mapping within attribute database 200 in accordance with an embodiment of the present invention. Security administrator 132 assigns several parameters for each user—for example user 214—within attribute database 200. These parameters include, but are not limited to, personal user data 236, identity certificate 238, default attribute 240, and several assigned attributes—such as assigned attributes 242, 244, 246, and 248. Note that the number of assigned attributes can be more or less than indicated in this example.
  • [0042]
    In operation, security administrator 132 maps each one of a user's assigned attributes to attributes 204 as illustrated. In this example, assigned attribute 242, 244, 246, and 248 are mapped to attribute 224, 228, 230, and 234 respectively. User 214 can then assume each of these attributes as desired. User 214 will be denied access to attribute 226 and attribute 232.
  • [0043]
    Creating an Attribute Database
  • [0044]
    [0044]FIG. 3 is a flowchart illustrating the process of creating an attribute database in accordance with an embodiment of the present invention. The system starts when security administrator 132 initializes master attribute database 108 (step 302). After initializing master attribute database 108, security administrator 132 creates the list of possible attributes 204 (step 304).
  • [0045]
    Next, security administrator 132 creates the list of users 202 (step 306). Security administrator 132 then maps each of users 202 to the user's assigned attributes within attributes 204 (step 308).
  • [0046]
    After establishing attribute database 200, security administrator 132 uses a cryptographic process to digitally sign attribute database 200 (step 310). Finally, security administrator 132 causes policy distributor 102 to distribute attribute database 200 to hosts 110 and 120 (step 312). Note that non-critical changes can be distributed in a “batched” manner, so that multiple changes to the attribute database are held until security administrator 132 chooses distribution or some threshold is reached. The system forces distribution for critical changes.
  • [0047]
    Adding and Deleting Users
  • [0048]
    [0048]FIG. 4 is a flowchart illustrating the process of adding and deleting a user to an attribute database in accordance with an embodiment of the present invention. The system starts by determining if security administrator 132 is adding or deleting a user (step 402). If security administrator 132 is adding a user, the system obtains an identity certificate for the user from a certificate authority (step 404). After obtaining the identity certificate, the system adds the user to users 202 (step 406).
  • [0049]
    If security administrator 132 is deleting a user at 402, the system first notifies the certificate authority that the user's identity certificate is no longer valid (step 408). After the certificate authority has been notified that the identity certificate is no longer valid, the system deletes the user from users 202 (step 410).
  • [0050]
    Finally, security administrator 132 causes policy distributor 102 to distribute attribute database 200 to hosts 110 and 120 (step 412). Note that non-critical changes can be distributed in a “batched” manner, so that multiple changes to the attribute database are held until security administrator 132 chooses distribution or some threshold is reached. The system forces distribution for critical changes.
  • [0051]
    Attribute Mapping
  • [0052]
    [0052]FIG. 5 is a flowchart illustrating the process of adding and deleting an attribute for a user in accordance with an embodiment of the present invention. The system starts by determining if security administrator 132 is adding or deleting an attribute for a user (step 502). If security administrator 132 is adding an attribute for a user, the system first locates the user record within users 202 (step 504). After locating the users record within users 202, the system adds the new attribute for the user (step 506).
  • [0053]
    If security administrator 132 is deleting an attribute for a user at 502, the system first locates the user record within users 202 (step 508). After locating the users record within users 202, the system deletes the attribute for the user (step 510).
  • [0054]
    Finally, security administrator 132 causes policy distributor 102 to distribute attribute database 200 to hosts 110 and 120 (step 512). Note that non-critical changes can be distributed in a “batched” manner, so that multiple changes to the attribute database are held until security administrator 132 chooses distribution or some threshold is reached. The system forces distribution for critical changes.
  • [0055]
    Distributing an Attribute Database
  • [0056]
    [0056]FIG. 6 is a flowchart illustrating the process of distributing an attribute database in accordance with an embodiment of the present invention. The system starts when policy distributor 102, 112, or 122 receives notification that a new attribute database 200 is available for distribution (step 602). Note that policy distributor 102 receives the notification from security administrator 132, while hosts 110 and 120 receive the notification, either directly or indirectly, from master host 100. To facilitate distribution of attribute database 200, the hosts within the system are arranged hierarchically. When a policy distributor receives notification of a new attribute database 200, the policy distributor notifies subordinate policy distributors as described below. Each policy distributor performs the same actions, therefore only policy distributor 112 will be described herein.
  • [0057]
    After receiving notification of a new attribute database 200, policy distributor 112 authenticates the source of the notification using any available cryptographic method (step 604). If the source of the notification is a valid source at 604, policy distributor copies new attribute database 200 to local storage across network 130 (step 606). Next, policy distributor 112 verifies the digital signature accompanying new attribute database 200 (step 608).
  • [0058]
    If the digital signature is valid at 608, policy distributor 112 installs new attribute database 200 as local attribute database 118 (step 610). After installing new attribute database 200, policy distributor 112 notifies the policy distributor within any subordinate host of the hierarchy of hosts that a new attribute database 200 is available (step 612).
  • [0059]
    The foregoing descriptions of embodiments of the present invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.

Claims (24)

    What is claimed is:
  1. 1. A method for managing user attributes in a distributed computing system, wherein user attributes determine access rights to a computer application: the method comprising:
    modifying an attribute database, wherein the attribute database includes a plurality of possible user attributes and a plurality of users;
    obtaining an identity certificate from a certificate authority;
    associating the identity certificate with a user from the plurality of users within the attribute database;
    assigning an attribute from the plurality of possible user attributes to the user, whereby the user is granted access rights based on the attribute and the identity certificate;
    storing the attribute assigned to the user in the attribute database; and
    distributing modifications to the attribute database to a plurality of hosts coupled together by a network.
  2. 2. The method of claim 1, further comprising:
    assigning a second attribute from the plurality of possible user attributes to the user; and
    storing the second attribute assigned to the user in the attribute database.
  3. 3. The method of claim 1, further comprising using secure communications for distributing modifications to the attribute database to the plurality of hosts.
  4. 4. The method of claim 1, further comprising signing the attribute database with a cryptographic signature to allow detection of unauthorized changes to the attribute database.
  5. 5. The method of claim 1, wherein a host of the plurality of hosts can distribute modifications to the attribute database to a subordinate host in a tree architecture.
  6. 6. The method of claim 1, further comprising allowing the user to assume any attribute stored in the attribute database that is assigned to the user.
  7. 7. The method of claim 1, further comprising:
    deleting the attribute assigned to the user from the attribute database; and
    redistributing the attribute database to the plurality of hosts.
  8. 8. The method of claim 1, wherein modifying the attribute database includes creating the attribute database.
  9. 9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for managing user attributes in a distributed computing system, wherein user attributes determine access rights to a computer application: the method comprising:
    modifying an attribute database, wherein the attribute database includes a plurality of possible user attributes and a plurality of users;
    obtaining an identity certificate from a certificate authority;
    associating the identity certificate with a user from the plurality of users within the attribute database;
    assigning an attribute from the plurality of possible user attributes to the user, whereby the user is granted access rights based on the attribute and the identity certificate;
    storing the attribute assigned to the user in the attribute database; and
    distributing modifications to the attribute database to a plurality of hosts coupled together by a network.
  10. 10. The computer-readable storage medium of claim 9, the method further comprising:
    assigning a second attribute from the plurality of possible user attributes to the user; and
    storing the second attribute assigned to the user in the attribute database.
  11. 11. The computer-readable storage medium of claim 9, the method further comprising using secure communications for distributing modifications to the attribute database to the plurality of hosts.
  12. 12. The computer-readable storage medium of claim 9, the method further comprising signing the attribute database with a cryptographic signature to allow detection of unauthorized changes to the attribute database.
  13. 13. The computer-readable storage medium of claim 9, wherein a host of the plurality of hosts can distribute modifications to the attribute database to a subordinate host in a tree architecture.
  14. 14. The computer-readable storage medium of claim 9, the method further comprising allowing the user to assume any attribute stored in the attribute database that is assigned to the user.
  15. 15. The computer-readable storage medium of claim 9, the method further comprising:
    deleting the attribute assigned to the user from the attribute database; and
    redistributing the attribute database to the plurality of hosts.
  16. 16. The computer-readable storage medium of claim 9, wherein modifying the attribute database includes creating the attribute database.
  17. 17. An apparatus that facilitates managing user attributes in a distributed computing system, wherein user attributes determine access rights to a computer application: the apparatus comprising:
    a modifying mechanism configured to modify an attribute database, wherein the attribute database includes a plurality of possible user attributes and a plurality of users;
    an identity certificate obtaining mechanism configured to obtain an identity certificate from a certificate authority;
    an associating mechanism configured to associated the identity certificate with a user from the plurality of users within the attribute database;
    an assigning mechanism configured to assign an attribute from the plurality of possible user attributes to the user, whereby the user is granted access rights based on the attribute and the identity certificate;
    a storing mechanism configured to store the attribute assigned to the user in the attribute database; and
    a distributing mechanism that is configured to distribute modifications to the attribute database to a plurality of hosts coupled together by a network.
  18. 18. The apparatus of claim 17, further comprising:
    the assigning mechanism that is further configured to assign a second attribute from the plurality of possible user attributes to the user; and
    the storing mechanism that is further configured to store the second attribute assigned to the user in the attribute database.
  19. 19. The apparatus of claim 17, further comprising a secure communications mechanism configured to distribute modifications to the attribute database to the plurality of hosts.
  20. 20. The apparatus of claim 17, further comprising a signing mechanism that is configured to sign the attribute database with a cryptographic signature to allow detection of unauthorized changes to the attribute database.
  21. 21. The apparatus of claim 17, wherein the communications mechanism associated with a host of the plurality of hosts is configured to distribute modifications to the attribute database to a subordinate host in a tree architecture.
  22. 22. The apparatus of claim 17, further comprising an authorization mechanism that is configured to authorize the user to assume any attribute stored in the attribute database that is assigned to the user.
  23. 23. The apparatus of claim 17, further comprising:
    a deleting mechanism that is configured to delete the attribute assigned to the user from the attribute database; and
    a redistributing mechanism that is configured to redistribute the attribute database to the plurality of hosts.
  24. 24. The apparatus of claim 17, wherein the modifying mechanism is further configured to create the attribute database.
US09813419 2001-03-20 2001-03-20 Method and apparatus for securely and dynamically managing user roles in a distributed system Active 2023-08-02 US6871279B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US09813419 US6871279B2 (en) 2001-03-20 2001-03-20 Method and apparatus for securely and dynamically managing user roles in a distributed system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09813419 US6871279B2 (en) 2001-03-20 2001-03-20 Method and apparatus for securely and dynamically managing user roles in a distributed system
US09863145 US6920558B2 (en) 2001-03-20 2001-05-22 Method and apparatus for securely and dynamically modifying security policy configurations in a distributed system

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US09863145 Continuation-In-Part US6920558B2 (en) 2001-03-20 2001-05-22 Method and apparatus for securely and dynamically modifying security policy configurations in a distributed system

Publications (2)

Publication Number Publication Date
US20020138738A1 true true US20020138738A1 (en) 2002-09-26
US6871279B2 US6871279B2 (en) 2005-03-22

Family

ID=25212317

Family Applications (1)

Application Number Title Priority Date Filing Date
US09813419 Active 2023-08-02 US6871279B2 (en) 2001-03-20 2001-03-20 Method and apparatus for securely and dynamically managing user roles in a distributed system

Country Status (1)

Country Link
US (1) US6871279B2 (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040128546A1 (en) * 2002-12-31 2004-07-01 International Business Machines Corporation Method and system for attribute exchange in a heterogeneous federated environment
US20070016782A1 (en) * 2005-07-14 2007-01-18 Microsoft Corporation User mapping information extension for protocols
US20070203564A1 (en) * 2006-02-28 2007-08-30 Boston Scientific Scimed, Inc. Biodegradable implants having accelerated biodegradation properties in vivo
CN102055763A (en) * 2010-12-14 2011-05-11 山东中创软件商用中间件股份有限公司 Rights management method and system
CN101005506B (en) 2006-01-17 2011-06-29 国际商业机器公司 System and method for dynamic security access
US8844024B1 (en) * 2009-03-23 2014-09-23 Symantec Corporation Systems and methods for using tiered signing certificates to manage the behavior of executables

Families Citing this family (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030131232A1 (en) * 2001-11-28 2003-07-10 Fraser John D. Directory-based secure communities
US20030130960A1 (en) * 2001-11-28 2003-07-10 Fraser John D. Bridging service for security validation within enterprises
WO2003079191A1 (en) * 2002-03-11 2003-09-25 Visionshare, Inc. Method and system for peer-to-peer secure communication
US20040064691A1 (en) * 2002-09-26 2004-04-01 International Business Machines Corporation Method and system for processing certificate revocation lists in an authorization system
US7361249B2 (en) * 2002-12-05 2008-04-22 Multimedia Games, Inc. Apparatus for applying a removable cover to a ticket substrate
US8195714B2 (en) 2002-12-11 2012-06-05 Leaper Technologies, Inc. Context instantiated application protocol
US20070127400A1 (en) * 2002-12-11 2007-06-07 Leader Technologies, Inc. Professional Services Communications Architecture
US7925246B2 (en) 2002-12-11 2011-04-12 Leader Technologies, Inc. Radio/telephony interoperability system
US20050063524A1 (en) * 2002-12-11 2005-03-24 Leader Technologies, Inc. Communication system and method
US7334013B1 (en) * 2002-12-20 2008-02-19 Microsoft Corporation Shared services management
US8468330B1 (en) 2003-06-30 2013-06-18 Oracle International Corporation Methods, systems, and data structures for loading and authenticating a module
US9100431B2 (en) 2003-07-01 2015-08-04 Securityprofiling, Llc Computer program product and apparatus for multi-path remediation
US9118708B2 (en) 2003-07-01 2015-08-25 Securityprofiling, Llc Multi-path remediation
US8984644B2 (en) 2003-07-01 2015-03-17 Securityprofiling, Llc Anti-vulnerability system, method, and computer program product
US20070113272A2 (en) 2003-07-01 2007-05-17 Securityprofiling, Inc. Real-time vulnerability monitoring
US9118711B2 (en) 2003-07-01 2015-08-25 Securityprofiling, Llc Anti-vulnerability system, method, and computer program product
US9118709B2 (en) 2003-07-01 2015-08-25 Securityprofiling, Llc Anti-vulnerability system, method, and computer program product
US9350752B2 (en) 2003-07-01 2016-05-24 Securityprofiling, Llc Anti-vulnerability system, method, and computer program product
US9118710B2 (en) 2003-07-01 2015-08-25 Securityprofiling, Llc System, method, and computer program product for reporting an occurrence in different manners
US7299493B1 (en) 2003-09-30 2007-11-20 Novell, Inc. Techniques for dynamically establishing and managing authentication and trust relationships
US7539614B2 (en) * 2003-11-14 2009-05-26 Nxp B.V. System and method for audio signal processing using different gain factors for voiced and unvoiced phonemes
US7636941B2 (en) * 2004-03-10 2009-12-22 Microsoft Corporation Cross-domain authentication
US7383271B2 (en) * 2004-04-06 2008-06-03 Microsoft Corporation Centralized configuration data management for distributed clients
US7590669B2 (en) * 2004-04-06 2009-09-15 Microsoft Corporation Managing client configuration data
US7774827B2 (en) * 2005-06-06 2010-08-10 Novell, Inc. Techniques for providing role-based security with instance-level granularity
US20070179802A1 (en) * 2005-09-14 2007-08-02 Novell, Inc. Policy enforcement via attestations
US20070061263A1 (en) * 2005-09-14 2007-03-15 Novell, Inc. Crafted identities
US8281374B2 (en) * 2005-09-14 2012-10-02 Oracle International Corporation Attested identities
US7676498B2 (en) * 2006-06-05 2010-03-09 International Business Machines Corporation Method and data processing system for managing user roles
US20090178131A1 (en) * 2008-01-08 2009-07-09 Microsoft Corporation Globally distributed infrastructure for secure content management
US20090205018A1 (en) * 2008-02-07 2009-08-13 Ferraiolo David F Method and system for the specification and enforcement of arbitrary attribute-based access control policies
US8910255B2 (en) * 2008-05-27 2014-12-09 Microsoft Corporation Authentication for distributed secure content management system
CN102272769A (en) * 2008-12-30 2011-12-07 诺基亚西门子通信公司 Service access control
JP5895605B2 (en) * 2012-03-05 2016-03-30 富士ゼロックス株式会社 Information management system, information management system, information management program

Citations (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6185678B2 (en) *
US6055534A (en) * 1995-07-20 2000-04-25 Fuji Xerox Co., Ltd. File management system and file management method
US6061726A (en) * 1997-05-27 2000-05-09 Novell, Inc. Dynamic rights assignment apparatus and method using network directory services
US6185678B1 (en) * 1997-10-02 2001-02-06 Trustees Of The University Of Pennsylvania Secure and reliable bootstrap architecture
US6202157B1 (en) * 1997-12-08 2001-03-13 Entrust Technologies Limited Computer network security system and method having unilateral enforceable security policy provision
US6216231B1 (en) * 1996-04-30 2001-04-10 At & T Corp. Specifying security protocols and policy constraints in distributed systems
US6246771B1 (en) * 1997-11-26 2001-06-12 V-One Corporation Session key recovery system and method
US6275825B1 (en) * 1997-12-29 2001-08-14 Casio Computer Co., Ltd. Data access control apparatus for limiting data access in accordance with user attribute
US6381579B1 (en) * 1998-12-23 2002-04-30 International Business Machines Corporation System and method to provide secure navigation to resources on the internet
US6430694B1 (en) * 1998-12-31 2002-08-06 At&T Corp. Method and apparatus for synchronizing the provision of data among geographically distributed databases
US6438549B1 (en) * 1998-12-03 2002-08-20 International Business Machines Corporation Method for storing sparse hierarchical data in a relational database
US6484258B1 (en) * 1998-08-12 2002-11-19 Kyber Pass Corporation Access control using attributes contained within public key certificates
US6499110B1 (en) * 1998-12-23 2002-12-24 Entrust Technologies Limited Method and apparatus for facilitating information security policy control on a per security engine user basis
US6507909B1 (en) * 1990-02-13 2003-01-14 Compaq Information Technologies Group, L.P. Method for executing trusted-path commands
US6516316B1 (en) * 1998-02-17 2003-02-04 Openwave Systems Inc. Centralized certificate management system for two-way interactive communication devices in data networks
US6539093B1 (en) * 1998-12-31 2003-03-25 International Business Machines Corporation Key ring organizer for an electronic business using public key infrastructure
US6584567B1 (en) * 1999-06-30 2003-06-24 International Business Machines Corporation Dynamic connection to multiple origin servers in a transcoding proxy
US6594661B1 (en) * 1999-12-27 2003-07-15 International Business Machines Corporation Method and system for controlling access to a source application

Patent Citations (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6185678B2 (en) *
US6507909B1 (en) * 1990-02-13 2003-01-14 Compaq Information Technologies Group, L.P. Method for executing trusted-path commands
US6055534A (en) * 1995-07-20 2000-04-25 Fuji Xerox Co., Ltd. File management system and file management method
US6216231B1 (en) * 1996-04-30 2001-04-10 At & T Corp. Specifying security protocols and policy constraints in distributed systems
US6256741B1 (en) * 1996-04-30 2001-07-03 At&T Corp. Specifying security protocols and policy constraints in distributed systems
US6061726A (en) * 1997-05-27 2000-05-09 Novell, Inc. Dynamic rights assignment apparatus and method using network directory services
US6185678B1 (en) * 1997-10-02 2001-02-06 Trustees Of The University Of Pennsylvania Secure and reliable bootstrap architecture
US6246771B1 (en) * 1997-11-26 2001-06-12 V-One Corporation Session key recovery system and method
US6202157B1 (en) * 1997-12-08 2001-03-13 Entrust Technologies Limited Computer network security system and method having unilateral enforceable security policy provision
US6275825B1 (en) * 1997-12-29 2001-08-14 Casio Computer Co., Ltd. Data access control apparatus for limiting data access in accordance with user attribute
US6516316B1 (en) * 1998-02-17 2003-02-04 Openwave Systems Inc. Centralized certificate management system for two-way interactive communication devices in data networks
US6484258B1 (en) * 1998-08-12 2002-11-19 Kyber Pass Corporation Access control using attributes contained within public key certificates
US6438549B1 (en) * 1998-12-03 2002-08-20 International Business Machines Corporation Method for storing sparse hierarchical data in a relational database
US6381579B1 (en) * 1998-12-23 2002-04-30 International Business Machines Corporation System and method to provide secure navigation to resources on the internet
US6499110B1 (en) * 1998-12-23 2002-12-24 Entrust Technologies Limited Method and apparatus for facilitating information security policy control on a per security engine user basis
US6430694B1 (en) * 1998-12-31 2002-08-06 At&T Corp. Method and apparatus for synchronizing the provision of data among geographically distributed databases
US6539093B1 (en) * 1998-12-31 2003-03-25 International Business Machines Corporation Key ring organizer for an electronic business using public key infrastructure
US6584567B1 (en) * 1999-06-30 2003-06-24 International Business Machines Corporation Dynamic connection to multiple origin servers in a transcoding proxy
US6594661B1 (en) * 1999-12-27 2003-07-15 International Business Machines Corporation Method and system for controlling access to a source application

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040128546A1 (en) * 2002-12-31 2004-07-01 International Business Machines Corporation Method and system for attribute exchange in a heterogeneous federated environment
US20070016782A1 (en) * 2005-07-14 2007-01-18 Microsoft Corporation User mapping information extension for protocols
US7434253B2 (en) * 2005-07-14 2008-10-07 Microsoft Corporation User mapping information extension for protocols
JP2009501973A (en) * 2005-07-14 2009-01-22 マイクロソフト コーポレーション User mapping information extensions for the protocol
CN101005506B (en) 2006-01-17 2011-06-29 国际商业机器公司 System and method for dynamic security access
US20070203564A1 (en) * 2006-02-28 2007-08-30 Boston Scientific Scimed, Inc. Biodegradable implants having accelerated biodegradation properties in vivo
US8844024B1 (en) * 2009-03-23 2014-09-23 Symantec Corporation Systems and methods for using tiered signing certificates to manage the behavior of executables
CN102055763A (en) * 2010-12-14 2011-05-11 山东中创软件商用中间件股份有限公司 Rights management method and system

Also Published As

Publication number Publication date Type
US6871279B2 (en) 2005-03-22 grant

Similar Documents

Publication Publication Date Title
Zissis et al. Addressing cloud computing security issues
US7013332B2 (en) Distributed policy model for access control
US6212636B1 (en) Method for establishing trust in a computer network via association
US7174563B1 (en) Computer network security system and method having unilateral enforceable security policy provision
US7310732B2 (en) Content distribution system authenticating a user based on an identification certificate identified in a secure container
US5958051A (en) Implementing digital signatures for data streams and data archives
US6138235A (en) Controlling access to services between modular applications
US8042163B1 (en) Secure storage access using third party capability tokens
US5802178A (en) Stand alone device for providing security within computer networks
US6058383A (en) Computationally efficient method for trusted and dynamic digital objects dissemination
US6052785A (en) Multiple remote data access security mechanism for multitiered internet computer networks
US7093296B2 (en) System and method for dynamically extending a DRM system using authenticated external DPR modules
US6353886B1 (en) Method and system for secure network policy implementation
US7434048B1 (en) Controlling access to electronic documents
US7748027B2 (en) System and method for dynamic data redaction
US20020078386A1 (en) Incorporating password change policy into a single sign-on environment
US7543336B2 (en) System and method for secure storage of data using public and private keys
US20040039925A1 (en) Key management
EP1132796A1 (en) Mobile code and method for resource management for mobile code
US5872847A (en) Using trusted associations to establish trust in a computer network
US5933826A (en) Method and apparatus for securing and storing executable content
US6029247A (en) Method and apparatus for transmitting secured data
US20080005339A1 (en) Guided enrollment and login for token users
US20060206925A1 (en) Delegating right to access resource or the like in access management system
US20070230706A1 (en) Method and apparatus for facilitating role-based cryptographic key management for a database

Legal Events

Date Code Title Description
AS Assignment

Owner name: NETWORK ASSOCIATES, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SAMES, DAVID L.;TALLY, GREGG W.;REEL/FRAME:011633/0779

Effective date: 20010312

AS Assignment

Owner name: NETWORKS ASSOCIATES TECHNOLOGY, INC., CALIFORNIA

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE'S NAME, PREVIOUSLY RECORDED AT REEL 011633 FRAME 0779;ASSIGNORS:SAMES, DAVID L.;TALLY, GREGG W.;REEL/FRAME:012233/0455

Effective date: 20010312

AS Assignment

Owner name: UNITED STATES AIR FORCE, NEW YORK

Free format text: CONFIRMATORY LICENSE;ASSIGNOR:NETWORKS ASSOCIATES TECHNOLOGY, INC.;REEL/FRAME:014952/0093

Effective date: 20040202

AS Assignment

Owner name: MCAFEE, INC., CALIFORNIA

Free format text: MERGER;ASSIGNOR:NETWORKS ASSOCIATES TECHNOLOGY, INC.;REEL/FRAME:019843/0441

Effective date: 20041119

FPAY Fee payment

Year of fee payment: 4

REMI Maintenance fee reminder mailed
SULP Surcharge for late payment

Year of fee payment: 7

FPAY Fee payment

Year of fee payment: 8

FPAY Fee payment

Year of fee payment: 12

AS Assignment

Owner name: MCAFEE, LLC, CALIFORNIA

Free format text: CHANGE OF NAME AND ENTITY CONVERSION;ASSIGNOR:MCAFEE, INC.;REEL/FRAME:043665/0918

Effective date: 20161220

AS Assignment

Owner name: JPMORGAN CHASE BANK, N.A., NEW YORK

Free format text: SECURITY INTEREST;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:045055/0786

Effective date: 20170929

Owner name: MORGAN STANLEY SENIOR FUNDING, INC., MARYLAND

Free format text: SECURITY INTEREST;ASSIGNOR:MCAFEE, LLC;REEL/FRAME:045056/0676

Effective date: 20170929